Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
This project is now read‑only. Starting Monday, February 2, please use https://ibm-ceph.atlassian.net/ for all bug tracking management.

Bug 2317833

Summary: [8.0] Internal urls are accessible with mgmt-gateway enabled
Product: [Red Hat Storage] Red Hat Ceph Storage Reporter: Vinayak Papnoi <vpapnoi>
Component: Ceph-DashboardAssignee: Redouane Kachach Elhichou <rkachach>
Status: CLOSED ERRATA QA Contact: Vinayak Papnoi <vpapnoi>
Severity: urgent Docs Contact: Anjana Suparna Sriram <asriram>
Priority: unspecified    
Version: 8.0CC: akraj, ceph-eng-bugs, cephqe-warriors, pegonzal, rkachach, tserlin
Target Milestone: ---Keywords: TestBlocker
Target Release: 8.0   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: ceph-19.2.0-20.el9cp Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2024-11-25 09:13:07 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Vinayak Papnoi 2024-10-10 13:11:31 UTC 
Description of problem:

With mgmt-gateway enabled, the internal URLs for prometheus or alertmanager are accessible when entered manually. This is a security breach as only the external URLs must be accessible with mgmt-gateway enabled.


Version-Release number of selected component (if applicable):

19.2.0-12.el9cp

How reproducible:

1/1

Steps to Reproduce:
1. Deploy a ceph 8.0 cluster
2. Deploy mgmt-gateway service using below command 
# ceph orch apply mgmt-gateway
3. Access the dashboard using the ip address (without port number)
4. Access the external URL for prometheus/alertmanager
eg. https://<ip>/prometheus/graph?g0.expr=&g0.tab=1&g0.stacked=0&g0.show_exemplars=0&g0.range_input=1h
5. Edit the URL to make it the internal URL
eg. https://<ip>:29443/internal/prometheus/graph?g0.expr=&g0.tab=1&g0.stacked=0&g0.show_exemplars=0&g0.range_input=1h


Actual results:

Internal URl is accessible

Expected results:

Internal URL must not be accessible

Additional info:
Comment 7 errata-xmlrpc 2024-11-25 09:13:07 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat Ceph Storage 8.0 security, bug fix, and enhancement updates), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2024:10216